An improper privilege management flaw allows a user configured with the all‑Java or Flowable workflow adapters, or a BPMN definition that bypasses admin approval, to exploit a REST API call that grants themselves one or more defined Roles. The attacker can obtain the corresponding Entitlements, effectively becoming an administrator and gaining full control over the Syncope deployment. This weakness is classified as CWE‑269 and, with a CVSS score of 9.8, represents a high‑severity compromise of confidentiality, integrity, and availability.

The vulnerability affects Apache Software Foundation’s Apache Syncope versions 3.0.0‑M0 through 3.0.16, 4.0.0‑M0 through 4.0.6, and 4.1.0‑M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 or later or 4.1.2 or later to resolve the issue.

The EPSS score is less than 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score of 9.8 reflects critical severity. The likely attack vector is a remote REST API call that an authenticated user can invoke. Once the endpoint is triggered, the user supplies role identifiers and receives elevated privileges without additional authorization checks. The lack of hard enforcement of privilege checks makes exploitation low cost and high impact for compromised accounts.